Reference
Validation glossary
The terms this category runs on, defined plainly — including the checks we don't perform, named as not-done-today rather than glossed over. Each term links to its full guide as it publishes.
- Email validation
- Checking that an address is well-formed and its domain can receive mail. Distinct from verification — it proves an address is worth sending to, not that a specific inbox exists. Full guide →
- Email verification
- Confirming an address can actually receive mail. Domain-level verification (an MX lookup) is reliable; mailbox-level verification needs an SMTP probe that many servers answer dishonestly. Full guide →
- Syntax validation
- Checking that an address is shaped correctly — the cheapest first layer. A regex proves shape, not that the domain exists or accepts mail. Full guide →
- MX record
- The DNS record naming a domain's mail servers. No MX record means no mailbox at that domain can receive mail, whatever the syntax says. Full guide →
- Disposable email
- A throwaway inbox (Mailinator, Guerrilla Mail and the like) that self-destructs in minutes. A signup-fraud and bounce signal; detection is list-based, so it catches known providers but never a brand-new one. Full guide →
- Role-based email
- A shared alias like info@, support@ or admin@ that belongs to a team, not a person. A legitimate address, but usually the wrong target for a personal onboarding sequence.
- Catch-all domain
- A domain configured to accept mail to every possible address. An SMTP "yes" on a catch-all proves the domain accepts mail, not that a specific mailbox exists — which is why mailbox probing collapses on them.
- SMTP mailbox verification
- Opening an SMTP conversation to ask whether a specific mailbox exists. Slow, rate-limited, and often answered with a hollow "yes", so Boundstone reports it as not_performed rather than guessing. Full guide →
- Email deliverability
- Whether a message reaches the inbox rather than just being accepted. It depends on list hygiene, authentication (SPF, DKIM, DMARC), sender reputation, engagement and content — validation is one input, not the whole picture.
- Spam trap
- An address seeded (pristine) or recycled by mailbox providers to catch senders with poor hygiene. Hitting one damages sender reputation, and no validator can reliably identify a live trap because a pristine trap looks like a normal, deliverable address.
- Bounce rate
- The share of sent mail rejected by the receiving server. Validating syntax, MX and disposable status before sending removes avoidable hard bounces that erode sender reputation.
- RFC 5322
- The internet standard defining email address and message format. Its full grammar is so intricate that a "complete" validation regex is impractical — and still can't prove a domain accepts mail. Full guide →
Phone
- E.164
- The international standard phone-number format: a leading +, the country code, then the national number — no spaces or punctuation, at most 15 digits. The unambiguous form to store. Full guide →
- Line type
- Whether a number is mobile, fixed-line, toll-free or VoIP, derived from numbering-plan metadata. Some ranges are genuinely fixed-or-mobile, and an honest tool says so rather than guessing. Full guide →
- HLR lookup
- A live query to a mobile carrier's Home Location Register to check whether a number is active and reachable right now. It's the only way to know a number rings — not_performed by default at Boundstone, and available as a paid opt-in (hlr:true, 5 credits) that returns carrier, ported status and reachability. Full guide →
- Number porting
- Keeping a phone number while switching carriers. It decouples a number from its original carrier, which is why prefix-based carrier data goes stale and needs a live lookup to correct. Full guide →
- Carrier lookup
- Identifying the network currently serving a number. Because of porting this needs a live query, not a static table, so Boundstone reports it as not_performed today. Full guide →
- libphonenumber
- Google's library encoding each country's numbering rules. It validates and formats numbers to E.164 offline, and is the metadata baseline Boundstone's phone tier builds on. Full guide →
IP address
- IPv4 / IPv6
- The two IP address formats — a dotted-quad (8.8.8.8) and eight colon-separated hextets with zero-compression (2606:4700::1111). Validation must handle both. Full guide →
- Private IP
- An address in an RFC 1918 range (10.x, 172.16–31.x, 192.168.x) that only exists inside a local network. A private address as a public request's source is a red flag.
- Bogon
- An address from unallocated or reserved space that should never appear as a public source. Seeing one is a classic spoofing or misconfiguration tell.
- CIDR notation
- A compact way to write an IP range as a base address plus a prefix length, e.g. 10.0.0.0/8. The prefix length sets how many addresses the block covers.
- IP classification
- Sorting a valid address into public, private, loopback, reserved, bogon and similar categories. It's pure arithmetic on the address bytes, so it costs nothing and needs no licensed data.
- IP geolocation
- Mapping an IP address to a country, region or city. It needs a licensed database, so Boundstone reports it as not_performed until that data ships. Learn more →
- Proxy / VPN / Tor detection
- Flagging whether an address belongs to an anonymity network or datacenter — a fraud signal. It requires licensed intelligence data and is not_performed by Boundstone today. Learn more →
General
- The honesty contract
- Boundstone's practice of returning checks.performed and checks.not_performed on every response — so you always know what a verdict was based on, and what it wasn't. Learn more →
- Signup fraud
- Fake or abusive account creation. No single signal catches it; combining disposable-email, phone-plausibility and IP-classification checks into a score works far better than any one alone. Full guide →
- Bulk validation
- Checking a whole CSV of records in one job instead of one call at a time. Boundstone reserves a credit per row and refunds any row that errors.
Early access — free tier is 250 credits/month, forever
The API is live — start free without waiting. This list gets benchmark № 001 the day it publishes. One email. We validate emails for a living — we're not going to spam yours.
You're on the list — one email when the benchmark drops. (We validated your address on the way in. Habit.)